CVE-2025-14037

{"id": "CVE-2025-14037", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14037", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-24T13:51:54.134445Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 5.8, "exploitabilityScore": 1.7}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "invelity", "product": "Invelity Product Feeds", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2.6"}], "defaultStatus": "unaffected"}]}], "published": "2026-03-21T04:16:51.263", "references": [{"url": "http://plugins.trac.wordpress.org/browser/invelity-products-feeds/trunk/classes/admin/classPluginSettingsManageFeedPage.php?marks=60#L60", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8f95276c-7486-4dbe-a79d-702fd6be9cfa?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6. This is due to missing validation and sanitization in the 'createManageFeedPage' function. This makes it possible for authenticated administrator-level attackers to delete arbitrary files on the server via specially crafted requests that include path traversal sequences, granted they can trick an admin into clicking a malicious link."}, {"lang": "es", "value": "El plugin Invelity Product Feeds para WordPress es vulnerable a la eliminaci\u00f3n arbitraria de archivos mediante salto de ruta en todas las versiones hasta e incluyendo la 1.2.6. Esto se debe a la falta de validaci\u00f3n y saneamiento en la funci\u00f3n 'createManageFeedPage'. Esto hace posible que atacantes autenticados con nivel de administrador eliminen archivos arbitrarios en el servidor mediante solicitudes especialmente dise\u00f1adas que incluyen secuencias de salto de ruta, siempre que puedan enga\u00f1ar a un administrador para que haga clic en un enlace malicioso."}], "lastModified": "2026-06-17T08:35:12.890", "sourceIdentifier": "security@wordfence.com"}